Security Basics: Re: Netinfo Manager

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2003-09-23 Gene Cronk wrote:
> Matteo wrote:
> > I'm using Mac OS 10.2.8 Server and today I was quite surprised to see
> > that a normal user on my server can obtain the encrypted passwords of
> > all the user just using the command "nidump password .":
> >
> > bash-2.05a$ nidump passwd .
> > nobody:*:-2:-2::0:0:Unprivileged User:/dev/null:/dev/null
> > root:*EncryptedPass:0:0::0:0:System Administrator:/var/root:/bin/tcsh
> > ...
> >
> > Isn't this a security flaw? Is Apple going to fix it in the next
> > release of Mac OS X (Panther)? Now, how to prevent users to see the
> > passwords of the other users?
> Wouldn't chown root nidump and chmod 700 nidump fix this?
I don't have an OS X at hand, but I think one could easily get another
copy of nidump onto the system and use this copy to dump the NetInfo
database.

Regards
Ansgar Wiechers

---------------------------------------------------------------------------
----------------------------------------------------------------------------